Claude Code 2.1.223 closes four ways the permission prompt could be lied to

Four of today's entries are the same class of defect. A Bash permission bypass "where a crafted command could hide parts of itself from permission checks" is fixed. So is a related one where "commands padded with tabs or invisible Unicode can no longer hide part of the command from the approval dialog." Workflow scripts could use dynamic import() to run code outside the workflow sandbox; that is closed. And an agent definition's bypassPermissions mode ignored the org bypass-permissions disable policy, so a setting an administrator had turned off could be turned back on from inside an agent file. The release also adds owner wildcards ("owner/*") to the strictKnownMarketplaces and blockedMarketplaces managed settings.

Why it matters: The approval dialog is the last human checkpoint in most people's factories, and the failure mode here is not that it was bypassed but that it displayed something other than what would run. A control you can read and still be wrong about is worse than no control, because it is the one you stop watching. If you run Claude Code with permission rules or an org policy, this is an update-now release.